Analysis

  • max time kernel
    1s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/04/2025, 23:25

General

  • Target

    dist/mapper/map.exe

  • Size

    5.2MB

  • MD5

    4b7ac12256a768c1f344de2f169f5728

  • SHA1

    40d63f9cf769b2304420737132cbd6a63a44eb96

  • SHA256

    0910c0d226f1f5cb9a6ffaabb70e08b194bbf0b21617beb88109c2cf10987c4e

  • SHA512

    e2f50413ba791b0cf6d92922b8f9db59e686837e8d2f9e1a097f0ad72cf59a66a8bbd2c0d5567e059ef2b05dc28aa443ad9409aced4475d55324096abe9abfaf

  • SSDEEP

    98304:4uUx/rgmBLSmmoVIuKZxi8MHs6W2ZVci5lQ9pOidDXCc41t7uGkNP:pUx/rdSmmylyxz6zVc03gDyc4gN

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dist\mapper\map.exe
    "C:\Users\Admin\AppData\Local\Temp\dist\mapper\map.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1572-0-0x00007FF79D0E4000-0x00007FF79D43F000-memory.dmp

    Filesize

    3.4MB

  • memory/1572-1-0x00007FFD59D70000-0x00007FFD59D72000-memory.dmp

    Filesize

    8KB

  • memory/1572-5-0x00007FF79D0C0000-0x00007FF79D977000-memory.dmp

    Filesize

    8.7MB

  • memory/1572-6-0x00007FF79D0E4000-0x00007FF79D43F000-memory.dmp

    Filesize

    3.4MB

  • memory/1572-7-0x00007FF79D0C0000-0x00007FF79D977000-memory.dmp

    Filesize

    8.7MB